OTP Generator

OTP types and when each one is appropriate

Numeric OTPs are the most common format — 4 to 8 digits sent over SMS or email for quick identity verification. They're short enough to type from memory but long enough to resist brute-force within a rate-limited window. TOTP (Time-based One-Time Password) uses a shared secret and the current Unix time divided into 30-second intervals to produce a 6-digit code — the same algorithm behind Google Authenticator and Authy. HOTP (HMAC-based OTP) increments a counter instead of using time, making codes valid until used rather than expiring automatically.

Security properties to understand before deploying OTPs

An OTP is only as secure as its delivery channel. SMS OTPs can be intercepted through SIM-swapping or SS7 vulnerabilities; they're adequate for low-stakes verification but shouldn't protect financial or medical accounts. TOTP is significantly stronger because the secret never leaves the device after initial enrollment. The generated codes work offline and aren't interceptable in transit. If you're using this tool to generate test codes during development, make sure your staging environment uses a separate secret from production — reusing secrets across environments defeats the isolation that OTP schemes depend on.